Verify the Microsoft Threat and Vulnerability Management integration import run status

Use the Microsoft Threat and Vulnerability Management (MS TVM) import run status to verify the success of your integration runs and to locate any issues.

Avant de commencer

This procedure makes the following assumptions:

• You have Vulnerability Response and the MS TVM Vulnerability Integration installed and configured.
• MS TVM Vulnerability Integration imports are scheduled and running.

Role required: sn_vul.vulnerability_admin

Pourquoi et quand exécuter cette tâche

During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.

Remarque :

The Last Record Processed field is updated based on what is defined in the following system properties:

• sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
• sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.

Procédure

1. Navigate to All > Microsoft Threat and Vulnerability Management > Integrations.
   1. Choose an integration.
   2. Click the Vulnerability Integration Runs related list.
2. Verify that the state of the imports is Complete, with the Substate as Success.
   The most common causes for a failed run are as follows:

   • Network interruption.
   • Bit decay in the data transfer resulting in corrupted data during the transform.
3. Facultatif : If you see one of these conditions that have caused a failed run, click Execute now and rerun the integration.